Exposure
How much of your crypto is quantum-exposed?
On a blockchain there is no key rotation and no revocation. Every public key that has been revealed on-chain is a permanent target: once a quantum computer can recover the private key, the balance behind it can be taken, and there is no way to un-reveal a key that is already public. This measures which of your balances are already on the wrong side of that line, and which are not yet.
Or try a known case
How exposure is decided
A balance is exposed when the public key protecting it is already recoverable from public chain data. On Bitcoin that is any output that carries the key directly (bare P2PK, and Taproot, which publishes the x-only key by design under BIP-341), plus any hash address that has been spent from, since spending publishes the key in the input. An address whose key has never been revealed is protected by a hash today, and is exposed only at its first spend. On Ethereum, any account that has ever sent a transaction has a public key recoverable from the signature.
There is no production post-quantum address to migrate to yet. Bitcoin’s BIP-360 (Pay-to-Merkle-Root) is a draft with no mainnet address type, and Ethereum’s post-quantum roadmap targets around 2029. Until then the only action that reduces risk is measurement and moving exposed value. NIST’s draft IR 8547 sets classical elliptic-curve signatures to be deprecated after 2030 and disallowed after 2035.
For infrastructure rather than balances, the same question applies to the exchanges and custodians that hold crypto. See the chain and custodian readiness index, and how each report is signed and verified.